https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:12 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74300 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci: validate codec capability element length</p> <p>Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes.</p> <p>hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps-&gt;len against the remaining skb length. A malformed controller response with one remaining byte and caps-&gt;len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list.</p> <p>Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci: validate codec capability element length</p> <p>Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes.</p> <p>hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps-&gt;len against the remaining skb length. A malformed controller response with one remaining byte and caps-&gt;len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list.</p> <p>Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.</p> https://vulnerability.circl.lu/vuln/cve-2026-74300